SNMP Management in BS2000/OSD

Transcription

1 SNMP Management in BS2000/OSD Issue April 2009 Pages 23 Summary The SNMP protocol provides the basis for integrated network, system and application management and enables processing procedures to be monitored as a static summary. The products currently available integrate BS2000/OSD systems in a central SNMP management, thus enabling BS2000/OSD systems to be monitored and controlled via SNMP from all management platforms that are compatible with SNMP. The individual management platforms differ in terms of functionality, quality and price. Standard solutions are now available for the most important BS2000/OSD components and are also being extended and developed further. Current offerings include not only the agents, but also integration products for management platforms, as well as applications to provide a clear network-wide display and convenient user interfaces. SNMP BS2000/OSD Customer-specific applications can be managed by means of an available toolkit with which users can create their own subagents. Fujitsu also offers project-specific support for this purpose. Due to the integration of BS2000/OSD, it is now possible to implement a central control station based on the SNMP protocol, from which all components of a heterogeneous IT landscape, including BS2000/OSD business servers, can be monitored and tested with the same method and tools. Information of the same type is always displayed and processed further by the same method even if the data involved comes from different operating systems. The entire network can thus be managed on a task- and function-specific basis, even across different systems. The early detection of problems and the facility to automatically initiate responses ensures higher availability, which leads to improved productivity, and thus ultimately to a more attractive bottom line. This document describes level 6 of the BS2000/OSD SNMP Management. The SNMP products will continue to be developed to reflect market requirements and new developments in standardization. This will enhance the functions of the existing agents. The management functions can be supplemented by providing support for further devices, allowing integration into other management platforms and migrating the applications to other systems such as LINUX. New protocol and MIB standards will be supported as they appear on the market. Description Issue: October 2004

2 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 2 / 23 Contents 1 Preface 3 2 Central Management with SNMP SNMP is standardized and uses existing infrastructures Network, system and application management Management architecture Management platform Management Activities Benefits of SNMP management 7 3 BS2000/OSD management using SNMP Embedding and functionality SNMP agent for BS2000/OSD Management applications Customizing the management platform Web access to the BS2000/OSD management HNC-SNMP Security considerations when using SNMP 18 4 Summary and outlook 21 5 Appendix - Management Information Base (MIB) 22 6 Abbreviations 23

3 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 3 / 23 1 Preface Modern enterprise-wide information processing is supported by specialized contributions from many different systems and applications. For example: BS2000/OSD systems maintain consolidated corporate data with powerful applications. Local printers are made available at the workplace. Routers and gateways serve as bridges across different network topologies. Web servers offer data and applications on the Internet or intranets. Mail servers maintain electronic mail. Firewalls reject unauthorized access attempts. Security servers control access rights. The individual systems are often not concentrated in one computer center, but distributed across various locations. Whereas the decentralized installation of servers was usually associated with a distribution of operational responsibilities in the past, a trend to revert to the centralization of operational responsibilities can be observed today. This means that the decentralized systems must be monitored or controlled via communication links, since the option of providing on-site support for the components must be excluded for economic reasons. Consequently, an increasing number of central management platforms that obtain information on the monitored components by using agents are now being installed. If required, the management stations can also be informed automatically by the agents. An agent is the software that runs on the monitored component and returns the required information on that component. The management platform and agents communicate in TCP/IP networks via the standardized management protocol SNMP (Simple Network Management Protocol). This White Paper discusses the following topics: Central management using SNMP SNMP management of BS2000/OSD and the connected peripherals Concept of a Management Information Base MIB (in the appendix) The following products are offered by Fujitsu for SNMP management of BS2000/OSD: SNMP-Basic-Agent BS2000 SNMP-Standard-Collection BS2000 SNMP subagent for openutm and SNMP subagent for SM2 One subagent for MIB-II and one BCAM-specific MIB, which are supplied with the opennet Server delivery unit SNMP agent for HNC Management In order to allow you to easily test the functions of SNMP management without having to buy these products, a free version of the product SNMP-LIGHT has been supplied since July 1998 with the correction package for BS2000 versions as of OSD V2.0. You will find details on how to install SNMP-LIGHT and on how to administer your BS2000/OSD system in steps in the "SNMP- LIGHT manual.

4 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 4 / 23 2 Central Management with SNMP SNMP stands for Simple Network Management Protocol. As in the case of TCP/IP, where the protocol name designates not only the protocols themselves, but also the entire TCP/IP network, the name SNMP refers to both the protocol and the entire SNMP management system. SNMP has now become not just one management protocol among many, but effectively the management protocol in TCP/IP-based networks. 2.1 SNMP is standardized and uses existing infrastructures SNMP was elevated to a standard by the IAB (Internet Architecture Board) and can use the same infrastructure that is required for TCP/IP. SNMP is standardized The IAB is responsible for standardization in the Internet domain. As in the case of the TCP/IP domain, even the documents relevant for SNMP are placed by the IAB in RFCs (Requests for Comments). SNMP uses existing infrastructures SNMP can use the same infrastructure as required by TCP/IP. Consequently, the link between the management platform and the monitored components can be established via any type of physical connection. 2.2 Network, system and application management SNMP was originally developed as a protocol for network management services on TCP/IP-based intranets. At first, it was only intended to perform the task of monitoring and administering LAN components such as bridges, routers and hubs in heterogeneous networks with TCP/IP protocols. Its performance has meant that the scope of SNMP has expanded with time to include system and application management, as a result of which SNMP is able to effectively integrate the originally disparate areas of network, system and application management into a uniform platform. SNMP is now universally used for all areas from cable management to power supplies and network devices, down to the systems themselves and the associated applications. In addition, SNMP supports the management of middleware such as databases and transaction monitors. 2.3 Management architecture The central component of an SNMP installation is a management platform, which consists of a console with graphics terminals that provide a clear overview of the administered components and a convenient user interface. The entire network, including its systems and applications, can be monitored and controlled from the management platform. The management platform serves as a host for the SNMP manager (also called a management station), which is actually an application that communicates with the SNMP agents across a TCP/IP network using SNMP. Each of the administered components hosts an agent, which returns current information on that component to the SNMP manager. Most of the controlling activities are initiated on the part of the SNMP manager, thus minimizing the load and management overhead on the administered components. The SNMP architecture can be viewed as a special client/server architecture with the SNMP manager as the client, and the agents operating as servers SNMP manager (management station) The SNMP manager is the software that generates Get or Set requests for the individual SNMP agents and sends them to the agents using SNMP. From the agents, the SNMP manager receives the responses to these sent requests as well as asynchronous messages (traps). The SNMP manager presents the ongoing management activities on a terminal with a graphical interface. At present, either a UNIX-based or Windows NT system is generally used for this purpose. The spectrum of the display facilities extends from the simple output of values to a full-blown visual representation of the monitored systems and applications in a network diagram with a display of events and sophisticated alarm management SNMP agent (management agent) An SNMP agent is the software that receives, executes and responds to the requests sent by the SNMP manager. Agents may also send asynchronous messages (traps) to the SNMP manager under certain circumstances. The agents thus perform the actual function of monitoring by directly working together with the monitored components, e.g. with an application or a job scheduling system. Every agent utilizes an appropriate interface to the components that it monitors. Master agent/subagents system (extensible agents) Current demands on an SNMP agent extend from simple network management to system and application management, and even the management of middleware (such as transaction monitors and databases). To enable the use of several taskspecific agents in large end systems, it is advisable to structure the agents as a single master agent with several subagents. Modern SNMP agents based on EMANATE technology are structured according to the master agent/subagents relationship. In other words, the functionality of the agent is divided between a single master agent and one or more subagents. This internal division of work between the master agent and the subagents is not visible to the SNMP manager. Agents that are structured in accordance with the master agent/subagents system can also be easily extended by adding more subagents. Such agents are therefore called extensible agents.

5 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 5 / 23 Master agent The master agent is a super ordinate agent with subagents below it. It handles all underlying tasks centrally such as the processing of the SNMP protocol, security functions and the monitoring of communications. Subagents Subagents are self-contained units and do not affect other subagents. This is important when monitoring complex systems with many subagents. Subagents can only operate if the master agent has been started Communication between the SNMP manager and SNMP agents The basis for communication between the SNMP manager and SNMP agents is the Management Information Base (MIB), which specifies a structure for describing all the objects to be administered. Management Information Base (MIB) For each component to be managed, and thus for every subagent, a separate MIB or section of a MIB is required. The MIB formally describes the relevant elements to be administered (objects) in the component involved as well as the attributes of these objects. Typical object attributes are the object name, syntax, access rights and status. The following types of MIBs exist: Standard MIBs, i.e., MIBs defined by standardization committees, in particular by IETF. One typical example is IETF standard 17, the MIB-II (RFC1213) for TCP/IP networks. MIBs that represent a de facto standard Private MIBs containing vendor-specific extensions Many hardware and software components are supplied with vendor-specific MIBs. You will find more information on MIBs in the appendix. SNMP protocol elements SNMP handles communications via the UDP protocol (User Datagram Protocol). Every individual message is fully and independently represented by a single datagram. This eliminates the additional overhead of executing functions for connection management. Only four different protocol elements are used in SNMP Version 1 (SNMPv1) to get, set and display values containing relevant management information (object values). A fifth protocol element, the trap, is used by agents to report asynchronous events to the SNMP manager. Security mechanisms Authorization for read/write access by the SNMP manager is verified by the community name. The community name is contained in every SNMP message and identifies the sender of the message as a member of a particular group or "community". A manager and agents can only communicate with one another if they belong to the same community. This relatively simple model has been expanded to a comprehensive security model in SNMPv3. This means that even if you use the SNMPv1 protocol, you can utilize important SNMPv3 functions in the SNMP products for BS2000/OSD. These include: selective assignment of access rights to MIB variables definition of access rights for a group of management stations detailed forwarding of traps 2.4 Management platform The main task of a management platform is to centrally collect, filter, display, process and log the information and events reported by the SNMP agents. This information may come from many sources such as system programs, log files, operating system messages and important customer-specific applications Features of management platforms Management platforms are characterized by the following features: Event processing Graphical display of managed components Alarm management Domain building Graphical management applications Event processing The management platform filters, prioritizes and groups the events reported by the agents. After the events have been edited accordingly, they can the visualized on a graphics terminal of the management platform. Events can also be associated with automatically executed actions. This is specially recommended in the event of errors for which the underlying causes can be eliminated by standard reactions. Graphical display of managed components The managed components are represented on the graphics terminal of the management platform as icons in topology maps or network diagrams. The different states are indicated by means of assigned colors. The network diagram consists of any desired background and the actual graphical representation of the managed components. Identical concepts and components are always represented by the same method, even if different system platforms are involved.

6 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 6 / 23 The network diagram provides the administrator with an overview of the following network elements. An example of a network diagram with a detailed representation of components in a selected BS2000/OSD system is shown in figure 1. Figure 1: Example of a network diagram Alarm management Various states and state transitions (alarms) are defined in a management station for the objects managed by that management station. Every event which occurs in a network or the state of every device, line or application which is reported to the management station can lead to a state transition, which is then displayed appropriately. It is equally important to initiate an action when a particular state is reached as it is to display the state in a network diagram. Domain building Some management platforms offer cascading facilities to support the natural structuring of networks in domains. Cascading enables the SNMP management to be modelled according to existing requirements and organizational structures. For example, the domain concept could be used to map enterprise-wide regulations and to define administrator/operator profiles that reflect both task-specific as well as organizational requirements. Apart from building administration domains, management platforms also allow to define a hierarchic structure. In such cases, important information is automatically forwarded from a management platform to a super ordinate entity. Graphical management applications Management platforms generally support basic functions for retrieving and setting SNMP variables. In order to execute a function, the user locates the appropriate position in the variable tree. Graphical applications on the management platform offer the convenience of a user friendly interface. Such applications can incorporate multiple variables in a complex decision model and then generate a graphical display of the values obtained from it. By using graphical management applications, even complex relationships can be mapped in a clear overview and shown to a system operator. In addition, each system operator can be provided with direct access to such applications from his or her management station Available management platforms A number of different management platforms are now competing in the commercial area. These management platforms offer powerful functions that are specially oriented to their respective market segments. The following is a selection of vendors and the management platforms they offer, listed in alphabetical order: APRISMA with Spectrum BMC with Patrol Computer Associates with Unicenter HP with OpenView SUN with Solstice Tivoli with NetView and Global Enterprise Manager (GEM) The management platforms available today usually support the installation of a central control station. All important enterprisewide information processing components can be integrated.

7 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 7 / Management Activities Three levels of management activities are offered to the administrator at the management station: General monitoring to check the functionality of all components on the network Detailed and targeted information retrieval via parameter values, load data and statistics Control via manual or automatic intervention in systems based on the obtained information Monitoring The general overview of monitored components displayed in topology maps makes it possible to conveniently monitor the entire area to be covered from a central control station of the management platform. These topology maps can usually be structured in the form of a tree. By combining components and applications into a higher-ranking node with a separate icon, the environment required for a development process can be statically defined and monitored as a whole. Monitoring methods: polling and traps There are two basic procedures to check the functionality and status of the central components on a network: polling and traps. Monitoring with polling Polling means that the management platform checks the status of the monitored systems and regular intervals. The active part of the communication here is handled by the SNMP manager, which controls the activities. The main advantage of polling is reliability. Even if an agent, the SNMP manager, or the network goes down temporarily, the monitoring process resumes on reestablishing communications and has no effect on the result. The important aspect here is to set a suitable polling interval that reflects a meaningful compromise between the network load and delays in obtaining information. Monitoring with traps A trap is an asynchronous message of an agent that indicates a problem status. The active part of the communication when monitoring with traps is assumed by the agent. The main focus here is on performance, so the network load is reduced to a minimum, and the trap is issued directly. Combined monitoring with polling and traps Since the SNMP protocol elements are sent using the connection-independent UDP protocol, it is possible for traps to be lost. This means that both monitoring methods are necessary to obtain reliable information on the current status of a component in the network. In practice, the method used for monitoring is very often a combination of polling and traps where a trap sent to the SNMP manager turns on the polling or lowers/raises the polling interval Detailed information retrieval In practice, it is often not possible to determine the cause of an error, for example, by merely displaying status values. In complex cases, apart from the information on the configuration, it may also be necessary to obtain specific details on a job (e.g. the priority of a print job). In addition, other cross-component and application details could also be relevant. Such information is displayed on the management platform in the form of tables or graphs Control It is sometimes necessary to control a component due to an external event or as a result of a failure. A typical example of an external event is the readying of a component at the start of a work session. One example of a controlling intervention after a failure is the rerouting of communications due to a line that is down. Such interventions can be performed manually if required, e.g. via emulations or integrated applications, but most management platforms also allow automatic reactions to be defined. This makes sense in cases where a unique reaction can be assigned to an error message, e.g. restarting an application following an abort message. 2.6 Benefits of SNMP management The following points summarize the reasons why SNMP is so widely used today: SNMP is standardized and provides management disciplines with a transparent transition between various vendor solutions. Since it is a standardized protocol, SNMP is supported by all the platforms widely available on the market and thus guarantees problem-free interaction between the agents and the various management platforms. SNMP uses the infrastructure required for TCP/IP networks. SNMP enables integrated network, system and application management from a central location. This centralized approach also permits the integration of other application domains such as a Help Desk, PC management, software distribution, etc. SNMP is a simple protocol that can be implemented easily with a relatively low overhead for the protocol engine. Due to the existing standard and the relatively simple implementation of SNMP agents, a wide range of SNMP agents exist. In addition, powerful development tools are available for developing customized agents. The tasks to be performed, i.e. alarm management, automatic reaction, logging, statistics, etc., can all be accomplished by using the same methods and tools. The polling mechanism of SNMP reduces the load of management activities on the monitored systems. Interoperability is guaranteed by the exclusion of options. All components of a process can be monitored and controlled even if some parts are executed on different systems or platforms within the framework of a client/server architecture. All identical concepts and components are always displayed by the same method.

8 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 8 / 23 Integrated applications on the management platform extend management facilities with additional functions. Even existing administration interfaces can be extended as needed by integrating graphical management applications on the management platform. SNMP, particularly in version 3 (SNMPv3), offers a comprehensive security model based on authorization and access controls.

9 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 9 / 23 3 BS2000/OSD management using SNMP Most BS2000/OSD systems today are part of a heterogeneous system landscape consisting of business servers, departmental servers, UNIX-based workstations and PCs, as well as network equipment such as routers and hubs. In order to monitor and control such distributed environments, an integrated network, system and application management is required. SNMP provides the basis for this by enabling all devices and systems to be administered centrally from a single management platform by means of the same procedures. 3.1 Embedding and functionality Four product lines with different objectives are available to connect BS2000/OSD to an SNMP-based management system. Figure 2 shows an overview of the SNMP integration of BS2000/OSD and the connected peripherals. Figure 2: Overview of the SNMP integration of BS2000/OSD The products SNMP-Basic-Agent BS2000 and SNMP-Standard-Collection BS2000 can be used to directly integrate BS2000/OSD systems in SNMP-based management platforms. The SNMP-Basic-Agent BS2000 and SNMP-Standard- Collection BS2000 allow network, system and application management via an implementation of the SNMP protocol in BS2000/OSD. The SNMP master agent also permits access to management information via a Web browser. The SNMP subagent for SM2, SNMP subagent for openutm, and the subagents for opennet Server (BCAM subagent) and internet Services are further additions to a steadily growing number of BS2000/OSD subagents. HNC (High-Speed Net Connect) connects Ethernet, FDDI and ATM networks with BS2000/OSD and supports the appropriate MIBs to allow SNMP monitoring - HNC as a whole - the components of HNC such as host and channel adapters and the power supply - the communication types Ethernet, FDDI and ATM 3.2 SNMP agent for BS2000/OSD BS2000/OSD systems are connected to LANs via the TCP/IP protocol. An SNMP agent that communicates with the SNMP manager on the management platform via SNMP is installed in BS2000/OSD. The functionality of the SNMP agent is divided into one master agent and a number of subagents. This solution has many advantages, including, among other things, reliability and user-friendliness in terms of maintenance and the overhead required for changes. Since a subagent notifies the master agent of the MIB branch for which it is responsible on initialization, the MIB can thus be dynamically extended or reduced as required. The technological basis of this solution is the EMANATE technologie (Enhanced MANagement Agent Through Extensions) from the company SNMP Research. EMANATE was ported to BS2000/OSD and is also available for Solaris, UNIX derivative from well-known vendors, as well as for Linux and Windows systems. The EMANATE master agent operates asynchronously. In other words, while subagents are processing their requests, the master agent can accept and process new SNMP requests. This improves reaction-time and throughput. The asynchronous interface for EMANATE is implemented via a threading mechanism, which is integrated in BS2000/OSD in the basic agent. The product structure and components of the agents for SNMP management available in BS2000/OSD are illustrated in figure 3.

10 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 10 / 23 Figure 3: Product structure of agents in BS2000/OSD and management components There are about 20 subagents in BS2000/OSD, which are offered in five products. This modular structure permits their selective use according to customer requirements SNMP-Basic-Agent BS2000 The base product SNMP-Basic-Agent BS2000 is a prerequisite for SNMP management in BS2000/OSD. The SNMP-Basic-Agent BS2000 includes the following components: Master agent Supervisor subagent Application Monitor subagent Console Monitor subagent HTML subagent Event subagent Scheduler subagent The SNMP master agent with its SNMP subagents in BS2000/OSD can be essentially connected to all management platforms via the SNMP protocol. The BS2000/OSD-specific MIBs, which are supplied in ASN.1 format, form the basis for this. There are also some other special products to facilitate the integration. Master agent The master agent forms the interface between the SNMP agents and the network, and thus to the management platform. It performs the following functions: Handling of the SNMP protocol and communication via a TCP/IP network with the SNMP manager on the management platform Checking access rights Forwarding requests from the SNMP manager to the responsible subagents Forwarding responses and traps from subagents to the SNMP manager

11 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 11 / 23 The master agent also allows access to management information via the World Wide Web. This means that it is possible to query and modify the information made available by the subagent not only in traditional SNMP applications, but also using a Web browser. If required, the master agent can also be linked with customer-defined subagents. Furthermore, in its capacity as the central management entity and SNMP protocol engine, the master agent implements the objects of the system group, the SNMP group of MIB-II and the SNMP framework. Among other things, the following information is included in the system group and the SNMP group of MIB-II: Runtime of the agent Name and type of system Number of incoming and outgoing packets Number of various protocol errors Number of security infringements (e.g. attempts to poll an agent using an invalid community name) Figure 4: Display of system data and basic data for the SNMP protocol Supervisor subagent The task of the Supervisor subagent is to monitor all the subagents connected to the master agent. The Supervisor subagent is very closely linked to the master agent and registers all events that are received by the master agent from the other subagents. The Supervisor subagent checks at regular intervals whether the other subagents can be reached and sends a trap to the SNMP manager in the following cases: when a subagent connects to the master agent or disconnects when a subagent can no longer be reached This means that on the part of the SNMP manager it is sufficient to poll only one instance for each BS2000/OSD system. This significantly reduces the network load caused by active monitoring on the part of the SNMP manager. For each subagent, the Supervisor subagent also returns, among other things, the following values: Status of the subagent (active, disconnected, undefined) Connect time Time of last communication Number of answered requests Number of traps sent Smallest supported OID (object identifier) Application Monitor subagent The Application Monitor subagent is a universal agent and is not assigned to any special BS2000/OSD component. It can be used to monitor the following units (objects), i.e. to query their states and properties: user applications BCAM applications DCAM applications

12 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 12 / 23 subsystems job variable log files Any change in status can be sent by the Application Monitor subagent to a management platform as a trap, even if not explicitly requested. This provides the basis for controlling user applications and tasks. Entries made in a specific file can also be sent as a trap. You can also administer groups of related applications as a single unit (object). You use a configuration file to configure the type and scope of application monitoring to suit your particular requirements. You pass the name of the configuration file to the Application Monitor subagent in the start command. Both options, i.e., traps and requests, enable the integration of universal application monitoring in the alarm management of a management platform. A separate management application is available for the Application Monitor subagent: the Console and Application Monitor. Console Monitor subagent Like the Application Monitor subagent, the Console Monitor subagent is also a universal agent and not associated with any special product. It communicates with the BS2000/OSD console. The Console Monitor subagent enables the console messages of BS2000/OSD to be recorded, filtered by different criteria to reduce the network load, and sent as a trap to the management platform. In the reverse case, the administrator at a management platform can issue BS2000/OSD console commands and have the results of the command execution displayed. On some management platforms, it is possible to have data automatically extracted from a message and inserted in certain console commands, which are then sent back to the BS2000/OSD system as an automatic reaction. A separate management application is available for the Console Monitor subagent: the Console and Application Monitor. HTML subagent The HTML subagent allows the definition of customized Web pages (custom pages) for access to management information on BS2000/OSD from the Web. This allows information from any MIB branches to be grouped according to different administrative considerations. The information on the various DR-Web pages is stored in the variables of the HTML MIB. Event subagent With the Event subagent you can monitor MIB objects of other subagents with periodic SNMP queries and carry out simple actions, as soon as specific conditions (trigger tests) have been satisfied. Actions can be: sending traps or carrying out SNMP set operations. Scheduler subagent The Scheduler subagent enables modifications to be made to objects periodically or at defined times. It is thus possible, for instance, to issue an SNMP set operation every Monday at 6:00 A.M. or even every last Friday in the month at 10:00 P.M. This type of scheduling can be activated or deactivated by modifying a control object. This makes a pre-configured scheduling possible which can be activated or deactivated by other management functions. A typical application for the SNMP set operations controlled by the Scheduler subagent is changing the administration status of MIB instances at specific times, e.g.: Status of an interface, by setting ifadminstatus Monitoring status in the Event subagent, by setting mtetriggerenabled Status of application monitoring by the Application Monitor subagent, by setting appmonlogfstate SNMP-Standard-Collection BS2000 The SNMP-Standard-Collection BS2000 is the product that enables various BS2000/OSD subsystems to be managed with SNMP. The following subagents for BS2000/OSD-specific subsystems are included in the SNMP-Standard-Collection: AVAS subagent openft(bs2000) subagent Subagent for HIPLEX Host Resources subagent Subagent for HSMS OMNIS subagent Subagent for basic performance monitoring with SM2 Subagent for the management of SESAM/SQL databases Subagent for Spool & Print Service Subagent for Storage Management AVAS subagent The subagent for the job scheduling system AVAS (job management and job handling system) enables the monitoring of an AVAS system in BS2000/OSD on three different information levels: On information level 1, the AVAS subagent returns details on the states of the processes and runtime systems needed for AVAS in the form of a single combined system status. This enables a general "ready state or a problem status for AVAS to be displayed on a management platform via a separate AVAS icon, for example. On information level 2, the AVAS subagent returns details in tabular form on the job nets, showing the individual production jobs. The display can be filtered by name (using wildcards) and status. On information level 3, the AVAS subagent returns details on the individual structure elements. These details can also be restricted in the display by using suitable filters.

13 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 13 / 23 openft(bs2000) subagent The openft(bs2000) subagent, or FT subagent in short, belongs to the group of subagents associated with application management. It returns details on FT system parameters and statistics for current operations. In addition, the FT subagent also enables specific actions, which include: starting and ending file transfers, controlling diagnostics, changing the public key for encryption purposes, and changing the state of FT partners. There is also an FT subagent in Solaris and Linux which offers the same functionality as the FT subagent in BS2000/OSD. HIPLEX subagent The HIPLEX subagent monitors high availability clusters from BS2000/OSD systems and supplies information on the current cluster configuration from the view of a subsystem. The HIPLEX subagent reports any important events and changes in the cluster to the management platform by means of traps, thus enabling the cluster to be monitored efficiently. The HIPLEX subagent uses HIPLEX MSCF and HIPLEX AF interfaces. Host Resources subagent The Host Resources subagent belongs to the group of subagents associated with system management. It uses the standardized MIB of RFC1514 and returns, among other things, information on working memory, devices, pubsets, POSIX file systems, and subsystems. Subagent for HSMS The HSMS subagent allows global HSMS data to be read and modified. In addition, it supplies detailed information on HSMS jobs and their states. The scope of the information displayed can be restricted on the basis of the criteria "state and "source. The HSMS subagent itself does not send any traps. OMNIS subagent The OMNIS subagent enables: stations, partners and applications to be monitored using OMNIS commands administration of the OMNIS control system itself Important events in the cluster, such as starting, termination or switching are reported using traps.the OMNIS subagent is declared to OMNIS as a special SNMP station. Subagent for basic performance monitoring with SM2 (PerfMonB) The subagent PerfMonB provides the basic functionality for performance management. PerfMonB enables the performance values of BS2000/OSD to be monitored to some extent by providing some basic details on CPU utilization and I/O rates as average values. The full functionality for performance monitoring is offered by the SNMP subagent for SM2. Subagent for the SESAM/SQL database system In accordance with RFC1697, the subagent for SESAM/SQL returns the following information: Installed databases Status information on the active open databases Status information on the installed database servers (SESAM/SQL DBHs) Configuration parameters and relevant resource limits for a server Relations of servers and databases on a host Changes in the status of the database handler are reported by the SESAM/SQL subagent with a trap. Subagent for the Spool & Print Service The subagent for the Print Service monitors SPOOL and RSO devices. It returns details on devices and print jobs on the basis of the same MIB as for UNIX-based systems. The following information is included for the device group: name, status, queues, error messages, waiting jobs, assigned host, administrator, etc. The following details are returned for the job group: number of entries, global job ID, origin, source host, destination, file, priority, size, status, etc.

14 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 14 / 23 Subagent for storage management The subagent for storage management provides information on pubsets and disks and on the availability of the storage products HSMS, MAREN and TLS. In addition, the following resource information is returned for a selected Public Volume Set (PVS): Capacity of the PVS Allocated storage space Utilization level (value range: level 1 to level 5; indicates potential storage bottlenecks) In addition, the subagent for storage management can monitor individual pubsets with regard to the saturation level or individual disks with regard to the reconfiguration state. If the state of a monitored pubset or disk changes, the subagent sends a trap to the management station SNMP subagents for opennet Server Two SNMP subagents are supplied with the BS2000/OSD communication manager opennet Server: MIB-II subagent (as of BCAM V13.0) Subagent for BCAM-specific settings and values (as of BCAM V14.0) MIB-II subagent A MIB-II subagent is available for network management in accordance with RFC This subagent covers only the TCP/IP protocol stack. The variables of the MIB-II are divided into the following groups (among others): Interfaces Group The Interfaces Group contains information on the type, addresses, status, amount of data transferred, and the problems that occurred during transmission for the existing network interfaces at the host. IP Group The P Group contains information on the number of sent and received IP datagrams and on the problems that occurred during transmission. Tables are available for assigning an IP address to the used network interface and to the hardware address. There is also a table with routing information. ICMP Group The CMP Group contains statistics on ICMP messages. This enables assertions to be made on the availability of IP hosts and on the errors that occurred on forwarding IP datagrams. TCP Group The TCP Group contains, among other things, the following information: Number of TCP connections Total number of transmitted data packets Number of attempts to set up or clear connections The TCP Group also includes a table showing the current connection partners and the status of each respective connection. UDP Group The UDP Group returns information on the total number of sent, received, invalid and undelivered UDP datagrams. It also includes a table of the locally reserved port numbers. SNMP subagent for BCAM specific settings and values As of BCAM Version V14.0, an additional private MIB is available that returns information on BCAM-specific settings and values. This MIB provides a logical view of the three protocol stacks TCP/IP, OSI and NEA and returns details on the following groups: Trap Group The Trap Group is the first group. It contains the definitions required to send traps. Global Group The Global Group contains BCAM-specific values that are valid for the whole of BCAM. Memory Group The Memory Group contains values that indicate the memory used by BCAM. Trace Group The Trace Group indicates the status of BCAM traces. TSAP Group The TSAP Group contains values specially related to applications. Connection Group The Connection Group contains values related to connections. Route Group The Route Group contains values related to routes (pairs of host addresses). Interface Group The Interface Group contains values related to network interfaces. Router Group The Router Group contains values related to routers (intermediate systems). Host Group The Host Group contains values related to hosts (local end systems).

15 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 15 / SNMP subagent for the Performance Monitor SM2 The SM2-based SNMP Performance Monitor subagent is available for BS2000/OSD systems as of BS2000/OSD-BC V2.0 and SM2 as of V11.2. It returns basic information on SM2 itself, i.e., on the status of the subsystem, the version, the size of the measuring interval and the sampling cycle. The actual values measured correspond to the known SM2 report groups and provide information on: CPU utilization I/O activities Utilization of main memory and the virtual address space Usage of main memory by the four standard categories of tasks Input and output operations on peripheral devices during a measurement interval Application-specific data of openutm applications Consumption values for individual tasks The presentation of measured values in a clear layout on the management platform is carried out by the Performance Monitor SNMP subagent for openutm in BS2000/OSD The SNMP subagent for the transaction monitor openutm in BS2000/OSD can be used to monitor selected openutm applications in BS2000/OSD. The objects involved, which are defined in an independent UTM MIB, can be queried and even set to some extent by the administrator from the management platform using SNMP. The following information is shown: Information on the application itself Statistics System parameters Physical and logical terminals Terminal pools Transaction codes and transaction classes User data Connections Sessions The administrator can change the system parameters and properties of an application by means of a SetRequest of the SNMP protocol. In addition, the administrator can also lock or unlock UTM terminals and terminate an openutm application. The subagent and the monitored openutm application communicate via the UPIC interface (Universal Programming Interface for Communication). Each of the openutm applications involved is accessed via an independent BCAM application name. 3.3 Management applications A number of specially customized management applications are available for individual subagents. These management applications have been tailored to the special properties and tasks of each subagent and can be installed on the existing management platform to enhance its display and handling. The management applications are supplied on CD-ROM together with the SNMPBASIC agent and are available for downloading free of charge on the Internet.The following special management applications are offered: Management applications BCAM Monitor BMBS2 Console and Application Monitor CMBS2 Performance Monitor PMBS2 Cluster Monitor CluMon Package name Related agents Management platform Operating system BMBS2 for Solaris: SMAWbmbs2 CMBS2 for Solaris: SMAWcmbs2 PMBS2 for Solaris: SMAWpmbs2 CluMon for Solaris: SMAWclumn BCAM subagent, MIB-II subagent opennet Server Console Monitor subagent (SBA-BS2) Application Monitor subagent (SBA-BS2) Performance Monitor subagent (SSA-SM2-BS2) HIPLEX subagent (SSC-BS2) standalone / integrated standalone / integrated standalone / integrated standalone / integrated Solaris / Linux / Windows Solaris / Linux / Windows Solaris / Linux / Windows Solaris / Linux / Windows BCAM Monitor The BCAM Monitor can be used to display the values returned by the MIB-II subagent in a graphical or tabular format in chronological order. This application is specially customized to the functionality of the MIB-II subagent and the BCAM subagent. A comprehensive Help system explains the functionality and handling of the application and offers detailed information on the values supported by the MIB-II subagent and the BCAM subagent. The BCAM Monitor can be optionally run as a "standalone application or integrated in a management platform.

16 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 16 / Console and Application Monitor The Console and Application Monitor BS2000 (CMBS2) is an SNMP management application used to monitor the BS2000/OSD console and applications. The Console and Application Monitor interoperates with two special subagents: Console Monitor subagent in BS2000/OSD Application Monitor subagent in BS2000/OSD Monitoring the console The Console Monitor subagent records the console messages and sends them individually as traps to the Console and Application Monitor. The basic functionality of the Console and Application Monitor is to display these messages. In addition to this display function, the Console and Application Monitor offers the following options: Filtering messages Highlighting and logging specific messages Conveniently replying to console queries Console commands You can use the Console and Application Monitor and the Console Monitor subagent in BS2000/OSD to execute console commands. It is also possible, commands before to define and to have executed automatically as reaction on events. Monitoring applications The Application Monitor subagent in BS2000/OSD monitors user and BCAM applications (by means of Monitor Job variables), DCAM applications, subsystems, job variables and logging files. The Application Monitor subagent can report any changes to the Console and Application Monitor with a trap. The following options are also offered here: Filtering messages Highlighting and logging specific messages Conveniently replying to console queries Independently of this, you can poll the status of the monitored subsystems and user applications at the Application Monitor subagent from the management platform. Automatic reactions You can define automatic reactions to respond to the problem messages which the Application Monitor subagent reports in a trap. Specify the criteria with which a reaction is to be triggered by a trap and define the reaction. The following are some options you may choose from: Send a BS2000 command Execute a local command Send mail Write an entry in a log file Execute any Tcl-Script Send a trap Figure 5 shows the main window of the Console and Application Monitor. Figure 5: Main window of the Console and Application Monitor

17 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 17 / Performance Monitor The Performance Monitor is a management application that is customized for the special features of the Performance Monitor subagent. The Performance Monitor can be used to monitor the performance of all BS2000/OSD systems on the network. It offers a clear graphical overview of the SM2 measurement values in the form of graphs or bar diagrams as well as tables. You can also have the values of multiple systems displayed simultaneously in a single diagram. In addition, you can set the polling intervals to check the systems, specify threshold values for the measured entities, and define reactions to be triggered on exceeding these values. For example, crossing a critical value could result in a trap, which triggers an alarm on the management platform. The Performance Monitor can be optionally run as a "standalone application or integrated in a management platform. The following two figures show the display of performance values by the Perfomance Monitor. Figure 6 gives an example for a curve diagram. CPU utilization is displayed for three different systems. Figure 6: Display of the CPU utilization for three different Systems Figure 7 gives an example for a bar diagram. CPU utilization and IO rates are displayed for three different systems. Figure 7: Display of CPU utilization and IO rates for three different systems 3.4 Customizing the management platform The management platforms from different vendors have different feature sets. This means that there are a number of criteria which may be of importance when choosing a management platform. BS2000/OSD systems can be essentially linked to any management platform that can handle the standard SNMP protocol. Since this applies to all the main management platforms available on the market today, the BS2000/OSD systems can always be integrated.

18 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 18 / Integration of BS2000/OSD in management platforms The following steps are generally required to integrate BS2000/OSD in a management platform: Enter all BS2000/OSD-specific MIBs on the management platform. Create menu entries and window layouts to display object values. Integrate nodes or device type definitions with icons for BS2000/OSD; copy the relevant icons for the various subagents, and place them in the network diagram. Provide definitions for the display in alarm or event management. Enter the respective system name and IP address of each BS2000/OSD configuration on the management platform. Some management platforms can perform this task via an automatic discovery function. Every management platform includes tools to support these tasks, but these tools usually require a high level of expertise and effort. For this reason, Fujitsu is now offering special integration packages for the management platforms listed below with which steps 1 through 4 for the integration of BS2000/OSD and all related subagents can be fully automated. Management platform Unicenter from CA Operating system Solaris / Windows NT Installation of SNMP agents and Management applications The agents offered in the SNMP-Basic-Agent BS2000 and SNMP-Standard-Collection 2000 products and the SNMP subagents for SM2 and openutm are installed on the BS2000/OSD host. Some configuration tasks for the agents are required on the management platform as well as in BS2000/OSD. The integration packages and management applications are installed on the management platform. BCAM Monitor, Console and Application Monitor and Performance Monitor can be optionally installed on a system running Windows NT, Solaris or Linux. 3.5 Web access to the BS2000/OSD management Besides processing SNMP requests, the SNMP master agent also enables management information to be accessed via the World Wide Web (WWW). The information provided by the subagent can thus be queried and modified both over an SNMP management platform and a web browser. Two different types of request The master agent polls the network for two different types of request: At the SNMP port (normally UDP 161), the master agent expects SNMP SetRequests and SNMP GetRequests. The master agent sends SNMP GetResponse messages in response to the SNMP Requests. At the web-based management port (normally TCP 280), the master agent expects HTTP connection requests. The master agent returns an HTML page to the browser in response to an HTTP message. This HTML page can be a predefined, user-specific web page (custom page) or an automatically generated web page (subtree page). The section of the master agent which is responsible for processing HTTP messages is called the HTTP engine. HTTP requests are processed in the same way as SNMP requests. When an SNMP or HTTP request has been evaluated, the master agent stores the relevant components of the request in an internal queue and obtains the information from the subagent in the usual way. As soon as the master agent has received the information from the subagent, it generates, depending on the type of request, an SNMP GetResponse message or an HTML page and returns this with the requested information to the sender of the original message. For the subagent, there is no difference between SNMP requests or requests from the web. 3.6 HNC-SNMP The SNMP management for the HNC 91849, HNC-II 91850, HNC-III and HNC-IIIR network access devices enables extensive monitoring of the components in the HNC. Separate MIBs are assigned to the various HNC components. The software package for integration in Unicenter includes a sophisticated alarm management function, which allows monitoring of all components and the availability of the network connections. 3.7 Security considerations when using SNMP This chapter provides notes and recommendations on how to implement secure use of the SNMP-based BS2000/OSD management system with security in mind. It is not however intended as a set of instructions on security analysis or on how to draw up security guidelines. Both of these important subjects go beyond the context of the present manual. For functional details of how to set the configuration parameters of the SNMP agent in BS2000/OSD with security in mind, see the manual "SNMP Management V5.0", section "3.3.1 Security configuration". Details on the corresponding settings for the management platform are described in the section "Integration in Unicenter" of the manual "SNMP Management V6.0" Security as a process Security is not just a product or a solution but also a process, comparable with processes involved in quality management. Only permanent security management can ensure durable security. The process "Protection for objects worth protecting" pursues the following objectives against inadvertent or arbitrary external and internal threats: confidentiality integrity availability responsible use

19 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 19 / 23 The process relies heavily on the guidelines in the security manual. A comprehensive security manual contains the following process steps: preventive measures recognition reaction Preventive measures Preventive measures include configuring security parameters correctly in accordance with the security rules. Preventive measures alone, however, do not guarantee security as security safeguards can never be perfect. Recognition Recognition involves logging the line operation and regularly checking logs of security-related incidents, such as repeated violation of access protection (infiltration attempts). Reaction Reaction involves checking: the adequacy and efficiency of the security rules whether the preventive measures need to be revaluated whether the mechanisms used in the recognition step need to be intensified Recommendations for general network and system security With the SNMP protocol you communicate across the internet. However, this exposes the participating systems to the potential attacks and risks associated with the public internet. i Recommendation Put the BS2000/OSD systems and management platform which are to be managed in a subnetwork over which you have exclusive control, for instance, behind a firewall. In this way, you can control access to your systems more easily and more centrally and counter any possible attacks. The security functions implemented in the SNMP agent are based on the fact that its configuration and program files are only accessible to privileged users, usually an administrator. The installation creates these files with the correct privileges. i Recommendation Check the configuration and program files of the SNMP agent in BS2000/OSD at regular intervals to ensure they are only accessible to privileged users Recommendations for using the SNMP service safely SNMP is insecure when used naively. The standard configuration effective with a minimum configuration after installation is a compromise between safety and comprehensive interoperability in the SNMP network, which tends toward interoperability requirements. Avoid live operation with a minimum configuration of the BS2000/OSD system. If you change the configuration on the BS2000/OSD system being managed, please adapt the corresponding settings on the management platform. i Recommendation Change the minimum configuration of the SNMP agent and the corresponding settings on the management platform in accordance with the guidelines of your security manual. You should be particularly careful from a security point of view with the following configuration parameters: Community strings for receiving SNMP requests Community strings and access control of MIB objects Community strings and sender addresses Recipient s addresses for SNMP traps Activating the sending of Authentication Failure Traps Community strings for receiving SNMP requests In SNMP terminology, a "community" denotes a group comprising one or more management platforms and several SNMP agents handled by these platforms. Every community is identified by a community string. The community string is a nonencrypted component of every SNMP request and identifies the sender of the request as a member of the community concerned. Authorization for a read or write request which a management platform sends to an SNMP agent is controlled with this community string. The community string makes a simple authentication mechanism available in SNMP. Management platforms and SNMP agents may only communicate with one another if they belong to the same community: the SNMP agent will only accept SNMP requests from management platforms whose community strings are known to it, i.e. preconfigured. Since the community string is sent in non-encrypted form with the SNMP message, it is always at a risk of being used without authorization. This can be problematic for using SNMP with security in mind. On the other hand, most communities use the preset community string "public" in any case.

20 White Paper Issue: April 2009 SNMP Management in BS2000/OSD Page 20 / 23 i i Recommendation Select suitable communities corresponding to the organization of your systems and operations and assign suitable community strings to them. Change the community string in accordance with the guidelines of your manual: in a similar way, for instance, as for passwords. Note that you must modify the community string in all participating systems in the community. Recommendation If the environment of your SNMP agents and management platform(s) allows you to do so, use the userspecific authentication available with the SNMPv3 protocol. Community strings and sender addresses You can explicitly preconfigure the IP addresses of the authorized management platforms. In this way, you force the SNMP agent to only accept SNMP requests from these systems. The management platforms must have fixed IP addresses to do this. It is not possible to dynamically assign them with the Dynamic Host Configuration Protocol (DHCP). i Recommendation Check the sender addresses of the management platforms by configuring their IP addresses in the SNMP agent. Recipient s addresses for SNMP traps You can explicitly predefine the IP addresses of the authorized management platforms to which an SNMP agent is to send SNMP traps. The management platforms must have constant IP addresses to do this. It is not possible to dynamically assign them with the Dynamic Host Configuration Protocol (DHCP). i Recommendation Predefine the receiver s addresses of the management platforms to receive SNMP traps. To do this, configure the IP addresses of these management platforms in the SNMP agent. Activating Authentication Failure Traps The SNMP agent checks every SNMP request in accordance with the configured security parameters and options (see preceding sections). If the SNMP request passes the checks, the agent processes it. Otherwise, the agent discards the SNMP request and sends an Authentication Failure Trap. By default, the sending of Authentication Failure Traps is deactivated. When it is activated, the SNMP agent sends this trap to all configured receivers. i Recommendation Configure the parameter snmpenableauthentraps, so that the sending of Authentication Failure Traps is activated. Configure a suitable receiver for traps like this. Check at regular intervals whether these traps have occurred and analyze all events of this type.